T09 · Insecure Skill Coding Practices
Note
- Location
- references/ref-144.md:3
- Finding
- Invisible Unicode Characters Reduce Instruction and Content Auditability## Vulnerability Details **File Location**: `references/ref-144.md:3`, `references/ref-150.md:3`, `references/ref-163.md:3`, and `references/ref-416.md:34-35` **Vulnerability Type**: Unexpected zero-width Unicode characters in agent-consumed Markdown **Risk Level**: Low ### Evidence The affected content contains invisible U+200D ZERO WIDTH JOINER characters. The security-relevant portions are represented below with explicit escapes because the original characters are not visually detectable: ```text references/ref-144.md:3 \u200D[renovation article text begins] references/ref-150.md:3 \u200D[renovation article text begins] references/ref-163.md:3 \u200D\u200D[renovation article text begins] references/ref-416.md:34-35 \u200D \u200D010[renovation article heading continues] ``` ### Technical Analysis The Markdown reference corpus is consumed as contextual material by the AI agent. Invisible Unicode format characters make the effective byte and character sequence differ from what a reviewer sees. This can defeat exact string matching, complicate content-diff review, and provide an obfuscation channel for future instruction injection. No concealed command, executable payload, instruction override, or malicious behavior was identified around the current characters. They appear to be content-import artifacts. The issue is therefore an auditability and content-integrity weakness rather than evidence of an active compromise. ### Attack Path 1. An attacker or compromised content importer introduces agent directives containing or separated by zero-width characters. 2. Visual review presents the altered text as ordinary reference content. 3. Exact-match controls or simple pattern scanners fail to recognize the obfuscated directive. 4. The AI agent consumes the effective text when loading the affected reference. 5. Depending on the added directive and the agent's instruction-handling controls, its response could b ...[truncated 742 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unexpected U+200D characters from all identified files. 2. Normalize every Markdown file to Unicode NFC during ingestion and before publication. 3. Add a CI check that rejects unexpected characters in the ranges U+200B–U+200D and U+FEFF unless a documented exception exists. 4. Render invisible characters explicitly in code-review diffs, for example as `\u200D`. 5. Re-run instruction-hijacking and encoded-content scans after normalization. 6. Validate imported articles against an allowlist of expected Unicode categories and quarantine files containing unexpected formatting controls.